Npm ecosystem already has the solution. Use namespaces @yelp/infra-js where @yelp is the npm user.

It's not possible for an attacker to publish on that name in the public npm